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SUBJECT:  Report  on  Quality  Control  Review  of  the  PriccwaterhouseCoopers,  LLP  and 
Defense  Contract  Audit  Agency  FY  2008  Single  Audit  of  the  Charles  Stark 
Draper  Laboratory,  Incorporated  (Report  No.  D-201 1-6-004) 

We  are  providing  this  report  for  your  information  and  use.  We  considered 
management  comments  on  a  draft  of  this  report  when  preparing  the  final  report.  As  the 
cognizant  Federal  agency  for  Charles  Stark  Draper  Laboratory  (the  Laboratory),  we 
performed  a  review  of  the  PricewatcrhouseCoopers,  LLP  and  the  Defense  Contract  Audit 
Agency  (DCAA)  single  audit  and  supporting  work  papers  for  the  audit  period 
July  1 , 2007,  through  June  27,  2008.  The  purpose  of  our  review  was  to  determine 
whether  the  single  audit  was  conducted  in  accordance  with  auditing  standards1  and  the 
auditing  and  reporting  requirements  of  the  Office  of  Management  and  Budget  Circular 
A- 133,  “Audits  of  States,  Local  Governments,  and  Non-Profit  Organizations,”  (Circular 
A- 133).  Appendix  A  contains  additional  background,  scope,  and  methodology  for  the 
review. 


Auditing  standards  include  both  Government  Auditing  Standards  and  the  American  Institute  of  Certified  Public  Accountants’ 
audit  standards. 


The  PricewaterhouseCoopers  office  in  Boston,  Massachusetts  performed  the  audit  of  the 
financial  statements.  PricewaterhouseCoopers  and  the  DCAA  Boston  Branch  Office  in 
Boston,  Massachusetts  performed  a  coordinated  audit  of  the  research  and  development 
program  cluster.  Appendix  B  presents  the  research  and  development  compliance 
requirements  and  the  division  of  audit  responsibility  between  PricewaterhouseCoopers 
and  DCAA  for  the  audit  period  ended  June  27,  2008. 

Background.  Charles  Stark  Draper  Laboratory  is  a  non-profit  scientific  research 
corporation  located  in  Cambridge,  Massachusetts.  The  laboratory  engages  in  scientific 
research,  development  of  prototype  operational  systems,  and  provides  technical  support 
to  government  programs. 

The  Laboratory  expended  $428.9  million  in  Federal  awards  for  the  fiscal  year  ended 
June  27,  2008,  under  one  federal  program,  the  research  and  development  cluster.  Of  the 
$428.9  million,  $362  million  was  expended  for  Department  of  Defense  programs. 

Review  Results.  The  Defense  Contract  Audit  Agency  did  not  comply  with  Circular 
A- 133  reporting  requirements.  As  a  result,  DCAA  must  revise  the  FY  2008  Circular 
A- 133  report  to  include  a  finding  to  provide  information  on  circumstances  surrounding 
the  qualification  of  the  compliance  opinion.  We  also  identified  deficiencies  in  the  review 
and  documentation  of  equipment  and  real  property  requirements,  performance  of  fraud 
risk  assessment  procedures,  and  audit  documentation  that  need  to  be  corrected  in  future 
audits.  In  addition,  we  identified  DCAA’s  failure  to  follow  its  policy  for  reporting 
noncompliance  with  cost  accounting  standards  that  should  be  resolved  by  the  DCAA 
Branch  Office.  We  also  identified  areas  where  additional  audit  guidance  is  needed  to 
ensure  compliance  with  auditing  standards  (Finding  A). 

The  PricewaterhouseCoopers  audit  of  the  financial  statements  and  the  research  and 
development  program  cluster  generally  met  auditing  standards  and  Circular  A- 133 
requirements.  However,  we  identified  a  deficiency  in  the  review  of  special  tests  and 
provisions  and  the  sufficiency  of  audit  documentation  that  needs  to  be  corrected  in  future 
audits  (Finding  B). 

Charles  Stark  Draper  Laboratory  complied  with  the  Circular  A- 133  reporting 
requirements.  However,  the  Laboratory  needs  to  take  future  actions  to  ensure  that  the 
single  audit  covers  all  programs  in  the  research  and  development  cluster  as  required  by 
Circular  A- 133  requirements.  In  addition,  the  Laboratory  will  have  to  re-submit  the 
FY  2008  Circular  A- 133  reporting  package  and  data  collection  form  to  the  Federal  Audit 
Clearinghouse  upon  receipt  of  the  revised  DC  AA  audit  report  (Finding  C). 


2 


Management  Comments  and  DoD  IG  Response.  DCAA,  PricewaterHouseCoopers 
and  the  Laboratory  agreed  to  take  the  recommended  actions.  Management  comments 
were  responsive  and  conformed  to  requirements;  no  additional  comments  are  needed. 
Management  comments  are  included  in  their  entirety  at  the  end  of  this  report. 

Finding  A.  Performance,  Documentation  and  Reporting  of  the  Federal  Program 
Audit.  DCAA  did  not  perform  and  document  adequate  procedures  for  relying  on  the 
work  of  the  Defense  Contract  Management  Agency  (DCMA)  for  the  review  of  equipment 
and  real  property  requirements  and  they  did  not  plan  and  perform  sufficient  fraud  risk 
assessment  procedures.  In  addition,  the  documentation  for  the  testing  of  internal  control 
over  compliance  for  allowable  activities,  allowable  cost  principles  and  the  procurement, 
suspension  and  debarment  requirements  did  not  fully  comply  with  auditing  standards. 
Further,  DCAA  did  not  comply  with  the  Circular  A- 133  reporting  requirements  because 
they  did  not  report  a  finding  related  to  the  qualified  opinion  on  compliance.  Also,  they 
did  not  follow  DCAA  reporting  policy  because  they  did  not  issue  a  report  to  the 
administrative  contracting  officer  on  the  Laboratory’s  noncompliance  with  two  cost 
accounting  standards.  In  addition,  we  identified  several  audit  areas  where  the  DCAA 
needs  to  improve  audit  guidance  through  revisions  to  the  Contract  Audit  Manual,  the 
standard  A- 133  audit  program,  or  other  appropriate  means  to  ensure  auditor  compliance 
with  auditing  standards  and  Circular  A- 133  requirements. 

Equipment  and  Real  Property.  DCAA  did  not  perform  sufficient  procedures  to 
allow  them  to  rely  on  the  DCMA  work  as  support  for  their  audit  conclusions  on  the 
review  of  equipment  and  real  property  compliance  requirements  (property  requirements). 
The  conclusions  on  the  effectiveness  of  internal  control  over  and  compliance  with 
property  requirements  were  primarily  based  on  a  property  system  analysis  performed  by 
DCMA,  a  non-audit  agency.  As  a  result,  the  DCAA  work  papers  did  not  contain 
sufficient  evidence  to  support  the  conclusions  on  compliance  with  property  requirements 
for  the  use,  management  and  disposition  of  property  acquired  under  federal  awards. 

There  was  no  documented  evidence  of  the  performance  of  tests  of  the  operating 
effectiveness  of  key  controls,  assessment  of  the  risk  of  non-compliance  and  performance 
of  tests  of  compliance  based  on  the  assessed  risk  as  required  by  Circular  A- 133. 

Circular  A- 133  requires  that  the  auditor  gain  an  understanding  of  internal  control  over 
compliance,  identify  and  test  key  internal  controls,  assess  the  risk  of  noncompliance  and 
determine  the  nature  and  extent  of  compliance  testing  needed  to  provide  sufficient 
evidence  to  support  the  auditor's  conclusion.  In  addition,  Circular  A- 133  requires  that  the 
single  audit  is  performed  by  an  auditor,  in  accordance  with  government  auditing 
standards.  Under  the  standards,  the  auditor  may  rely  on  the  work  of  others  if  they  take 
the  proper  steps  to  ensure  that  the  scope  of  the  work  is  sufficient  to  meet  the  audit 
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objectives  and  if  they  perform  additional  procedures,  as  described  in  the  standards,  to 
evaluate  the  quality  and  effectiveness  of  the  work  performed 

Based  on  our  review  of  the  work  papers,  we  concluded  that  DCAA  did  not  ensure  that  the 
scope  of  the  DCMA  work  met  the  Circular  A- 133  audit  requirements.  DCAA  did  not 
coordinate  with  the  DCMA  property  administrator  in  advance  of  the  property  system 
analysis  to  ensure  that  the  approach  and  scope  of  the  review  would  meet  the  objectives  of 
the  single  audit.  The  DCAA  work  papers  provided  a  general  description  of  the  DCMA 
procedures  and  noted  the  analyst's  conclusions;  however,  the  documentation  did  not 
address  the  key  internal  controls  tested,  an  assessment  of  the  risk  of  noncompliance, 
identify  the  sampling  methodology  used  for  selecting  equipment  for  compliance  testing 
or  identify  the  equipment  tested.  In  addition,  DCAA  did  not  perform  additional 
procedures  on  the  analyst’s  work  or  perform  additional  tests  of  controls  and  compliance 
to  evaluate  the  quality  and  effectiveness  of  the  DCMA  work  performed.  As  a  result, 
there  was  insufficient  evidence  in  the  working  papers  to  support  the  auditor's  judgment  to 
place  reliance  on  DCMA’s  review  as  support  for  DCAA’s  conclusions  on  the  adequacy 
of  internal  control  over  and  compliance  with  property  management  requirements. 

As  part  of  our  review  on  the  adequacy  of  the  DC  AA  audit  approach  for  property 
management  requirements,  we  evaluated  the  current  DCAA  Contract  Audit  Manual 
guidance  on  the  use  and  evaluation  of  non-auditor  work  products  in  meeting  the 
objectives  of  the  Circular  A- 133  audit.  Chapter  13-703  “Coordinated  Audit  Approach” 
provides  guidance  on  implementing  a  coordinated  audit  approach  in  the  Circular  A- 133 
audit  and  discusses  using  the  work  of  non-auditors.  The  guidance  identifies  non-auditors 
as  participants,  and  requires  that  all  participants  under  this  approach  coordinate  in 
advance  of  performing  the  audit  to  ensure  that  the  scope  of  work  is  sufficient  to  meet  the 
audit  and  review  responsibilities  of  all  participants.  The  guidance  also  states  that  the 
auditor  "must  perform  steps  necessary"  to  place  reliance  on  non-auditor  work;  however, 
the  guidance  does  not  elaborate  on  the  required  procedures  or  discuss  factors  that  would 
influence  the  extent  of  procedures  such  as  the  significance  of  the  non-auditor  work  to  the 
audit  objectives  and  degree  the  work  will  be  used  to  support  the  audit  conclusions. 

Because  of  the  deficiencies  noted,  the  DC  AA  auditors  need  additional  guidance  when 
relying  on  the  work  of  non-auditors  to  accomplish  the  objectives  of  the  Circular  A- 133 
audit.  In  addition,  we  will  recommend  that  the  Boston  Branch  Office  take  corrective 
actions  in  future  Circular  A- 133  audits  when  relying  on  the  work  of  non-auditors  to 
ensure  that  they  have  sufficient  evidence  to  support  their  audit  conclusions. 

Fraud  Risk  Assessment  Procedures.  DCAA  did  not  perform  sufficient  fraud 
risk  assessment  procedures  during  the  planning  and  performance  of  the  audit.  The 
Circular  A- 133  audit  program  procedures  simply  require  the  auditor  to  evaluate  the  fraud 
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risk  indicators  identified  in  the  DoDIG  “Handbook  on  Fraud  Indicators  for  Contract 
Auditors.”  The  working  papers  documented  that  the  evaluation  of  fraud  indicators  was 
limited  to  a  review  of  the  permanent  files  and  “other  recent  audit  activities”  performed  at 
the  Laboratory.  Based  on  this  review,  DCAA  concluded  that  there  were  no  identified 
fraud  risks. 

OMB  Circular  A- 133  requires  that  the  single  audits  be  performed  in  accordance  with 
government  auditing  standards  applicable  to  financial  statements,  which  incorporate  the 
American  Institute  of  Certified  Public  Accountants  (AICPA)  auditing  standards.  AICPA 
auditing  standards,  AU  §316,  “Consideration  of  Fraud  in  a  Financial  Statement  Audit,” 
requires  the  auditor  to  plan  and  perform  the  audit  to  obtain  reasonable  assurance  that 
material  misstatements  and  noncompliance,  whether  caused  by  error  or  fraud,  are 
detected.  Specifically,  as  a  means  of  obtaining  information  needed  to  identify  fraud  risk 
areas,  the  standards  require,  among  other  procedures,  inquiries  of  management  during  the 
planning  process  to  determine  if  they  have  knowledge  of  any  fraud  or  suspected  fraud 
affecting  the  entity. 

DCAA  needs  to  revise  the  guidance  on  required  fraud  risk  assessment  procedures  in  both 
the  standard  Circular  A- 133  audit  program  and  the  Contract  Audit  Manual  to  ensure  that 
auditors  are  knowledgeable  of  the  auditing  standard  requirements  for  the  consideration  of 
fraud  in  a  Circular  A- 133  audit. 

The  need  for  revised  guidance  on  fraud  risk  assessment  procedures  was  previously 
reported  in  our  audit  report  D-201 1-6-002,  dated  October  29,  2010  “Report  on  Quality 
Control  Review  of  the  Deloitte  &  Touche  and  the  Defense  Contract  Audit  Agency 
FY  2008  Single  Audit  of  the  Aerospace  Corporation”.  DCAA  management  concurred 
with  our  recommendations  for  revisions  and  plans  to  take  corrective  actions  by 
January  2011.  However,  until  the  corrective  actions  are  complete  we  will  continue  to 
include  the  finding  on  risk  assessment  procedures  and  the  recommendation  for  revisions 
in  our  reports  when  appropriate. 

Federal  Program  Documentation.  DCAA  did  not  adequately  document  the 
review  of  internal  control  over  compliance  with  the  activities  allowed  and  allowable  cost 
principle  requirements  (allowable  cost),  and  the  procurement  suspension  and  debarment 
requirements  (procurement).  DC  AA  documented  their  understanding  of  internal  control 
over  compliance  for  both  the  allowable  cost  and  the  procurement  requirements,  but  did 
not  document  the  specific  key  controls  they  intended  to  test.  The  working  papers  indicate 
that  the  auditor  planned  to  rely,  in  part,  on  internal  control  testing  performed  in  other 
audit  assignments;  however,  the  working  papers  did  not  provide  a  clear  audit  trail  to  the 
control  testing  performed. 
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DCAA  subsequently  provided  additional  documentation  that  identified  the  prior 
audits  and  control  testing  relied  on.  However,  although  the  documentation  included  some 
current  year  testing  of  controls,  many  of  the  examples  were  descriptions  of  existing 
policies  and  procedures  rather  than  tests  of  the  operating  effectiveness  of  specific 
controls.  In  addition,  the  documentation  provided  showed  that  the  auditor  also  relied  on 
controls  tested  in  FYs  2004  and  2005  as  support  for  the  FY  2008  review  conclusions. 

This  approach  is  not  in  accordance  with  the  AICPA  auditing  standards  considered 
applicable  to  the  Circular  A- 133  audit  at  the  time  of  the  DCAA  audit.  AU  318, 
"Performing  Audit  Procedures  in  Response  to  Assessed  Risks  and  Evaluation  of  Audit 
Evidence  Obtained,"  states  that  although  it  is  a  matter  of  professional  judgment  to  rely  on 
audit  evidence  obtained  in  prior  audits,  the  length  of  time  between  retesting  controls 
should  not  exceed  more  than  two  years.  As  a  result  of  these  deficiencies,  we  spent 
considerable  time  obtaining  verbal  explanations  and  reviewing  additional  information  in 
order  to  make  a  determination  on  the  sufficiency  of  the  audit  evidence  to  support  the 
auditor’s  conclusion. 

In  addition,  DCAA  should  review  the  A- 133  audit  program  and  the  Contract  Audit 
Manual,  Chapter  13,  to  ensure  that  the  guidance  conforms  with  the  standards  and 
guidance  in  Statement  on  Auditing  Standards  117  “Compliance  Audits”  issued  in 
December  2009  and  revise  its  guidance  as  necessary.  The  standard  was  primarily 
developed  in  response  to  the  results  of  a  federal  study  which  showed  that  improvements 
were  needed  in  the  performance  of  the  Circular  A- 133  audit. 

Statement  on  Auditing  Standards  1 1 7  establishes  standards  and  application  guidance  on 
performing  and  reporting  on  the  audit  of  compliance  when  the  auditor  is  required  to 
express  an  opinion  on  compliance  in  accordance  with  auditing  standards  and  government 
audit  requirements.  The  standard  incorporates  the  AICPA  risk  assessment  standards  and 
requires  the  auditor  to  adapt  and  apply  the  AICPA  auditing  standards  to  a  compliance 
audit.  The  standard  and  the  associated  application  guidance  will  influence  DCAA’s 
approach  to  the  review  of  internal  control  in  the  Circular  A-133  audit  (see  footnote  2). 

Reporting  Audit  Findings  in  Accordance  with  Circular  A-133  and  the 
Defense  Contract  Audit  Manual  Requirements.  DCAA  did  not  comply  with  the 
Circular  A-133  reporting  requirements  because  they  did  not  report  a  finding  related  to  the 
qualified  opinion  on  compliance  and  they  did  not  follow  DCAA  reporting  policy  because 
they  did  not  issue  a  report  to  the  administrative  contracting  officer  on  the  Laboratory’s 
noncompliance  with  two  cost  accounting  standards. 


2  Statement  on  Auditing  Standards  117  issued  in  December  2009  and  effective  for  audits  of  fiscal  periods  ending  on  or  after  June 
15,  2010  no  longer  permit  the  auditor  to  rely  on  audit  evidence  obtained  in  prior  audit  as  evidence  of  the  operating  effectiveness 
of  controls  in  an  annual  Circular  A-133  audit  (AU  801  pars.  20  and  A24) 
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Circular  A-1 33  Audit  Requirements.  DCAA  did  not  comply  with  Circular 
A- 133  reporting  requirements  because  they  did  not  report  the  circumstances  surrounding 
the  qualification  of  the  opinion  on  compliance  for  the  research  and  development  program 
in  the  schedule  of  findings  and  questioned  cost.  DCAA  qualified  the  report  on 
compliance  with  federal  program  requirements  because  they  did  not  have  access  to 
certain  awards  due  to  externally  imposed  restrictions  and  they  were  unable  to  satisfy 
themselves  on  compliance  with  program  requirements  by  other  auditing  procedures. 

Circular  A- 133  § _ .510(a)(5)  requires  that  the  auditor  report  as  an  audit  finding  in  the 

federal  awards  section  of  the  schedule  of  findings  and  questioned  costs  the  circumstances 
concerning  why  the  auditor's  report  on  compliance  is  other  than  an  unqualified  opinion, 
unless  the  circumstances  are  otherwise  reported  as  an  audit  finding  in  the  schedule. 

Cost  Accounting  Standard  Noncompliance  Reporting.  DCAA  did  not 
comply  with  the  DCAA  Contract  Audit  Manual  guidance  for  reporting  instances  of 
noncompliance  with  cost  accounting  standards  to  the  administrative  contracting  officer 
for  resolution  and  disposition  actions.  The  Contract  Audit  Manual  section  8-302. 7(c) 
requires  the  auditor  to  issue  a  separate  report  on  all  significant  cost  accounting  standard 
violations.  Separate  reporting  of  noncompliant  practices  ensures  that  the  administrative 
contracting  officer  has  timely  and  complete  information  to  perform  their  responsibilities 
for  the  administration  of  cost  accounting  standards.  In  addition,  issuing  separate 
noncompliance  reports  support  the  DoD  contract  audit  follow-up  process  by  providing  a 
mechanism  for  tracking  government  actions  on  audit  findings  and  recommendations. 

DCAA  audited  the  annual  incurred  cost  audit  as  part  of  the  Circular  A- 133  audit.  The 
results  of  the  audit  included  questioned  costs  some  of  which  resulted  from  noncompliant 
practices  with  the  requirements  of  cost  accounting  standards  405  “Accounting  for 
Unallowable  Cost,”  409  “Depreciation  of  Tangible  Assets,”  and  41 1  “Accounting  for 
Acquisition  Cost  of  Material.”  The  questioned  costs  were  reported  in  the  Circular  A- 133 
audit  report,  however,  except  for  the  noncompliance  with  cost  accounting  standard  411, 
the  auditor  did  not  issue  separate  reports  on  the  noncompliant  practices  related  to  the 
accounting  for  unallowable  costs  and  the  depreciation  of  tangible  assets. 

In  the  response  to  our  draft  report,  DCAA  states  they  re-evaluated  their  basis  for  citing 
the  Laboratory  was  in  noncompliance  with  cost  accounting  standard  409.  Based  on  their 
re-evaluation,  DCAA  concluded  that  the  Laboratory  is  in  noncompliance  with  cost 
accounting  standard  406  “Cost  Accounting  Period.”  As  a  result,  DCAA  plans  to  issue  the 
appropriate  noncompliance  report  to  the  administrative  contracting  officer.  In  addition, 
they  will  address  this  error  in  the  revised  FY  2008  Circular  A- 133  audit  report. 

The  Contract  Audit  Manual  section  8-3 02. 7(a)  states  that  “noncompliance  reports  should 
include  only  cost  accounting  standards  violations  that  the  auditor  considers  significant” 
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and  the  Manual  provides  four  general  conditions  under  which  a  noncompliance  would  be 
considered  significant  and  should  be  reported.  We  were  unable  to  find  any 
documentation  in  the  audit  file  to  explain  the  auditor’s  rationale  for  not  issuing  separate 
noncompliance  reports  as  required. 

We  discussed  the  failure  to  issue  reports  with  the  DCAA,  and  we  were  advised  that  a 
decision  was  made  not  to  issue  the  reports  until  after  the  administrative  contracting 
officer  made  a  final  determination  on  the  allowability  of  the  questioned  costs  identified  in 
the  FY  2008  Circular  A- 133  report.  However,  the  consideration  of  noncompliant 
practices  goes  beyond  resolving  the  impact  of  questioned  costs  on  audited  accounting 
period.  Noncompliant  practices  need  to  be  corrected  for  the  potential  impact  on  future 
contract  costs  as  well.  Therefore,  DCAA  should  have  issued  the  noncompliance  reports 
to  ensure  that  the  contracting  officer’s  determination  and  resolution  actions  address  any 
required  changes  to  accounting  practices  as  well  as  the  resolution  of  questioned  cost. 

Contract  Audit  Manual  Guidance  on  Reporting  Internal  Control 
Deficiencies.  The  DCAA  Contract  Audit  Manual  Chapter  13,  “Audits  at  Educational 
Institutions,  Nonprofit  Organizations,  and  Federally  Funded  Research  and  Development 
Centers,”  section  700,  “OMB  Circular  A- 133  Audits  and  Reports,”  should  be  updated  to 
reflect  the  current  terminology  on  communicating  internal  control  matters  in  accordance 
with  OMB  Circular  A- 133  reporting  requirements.  Specifically,  effective  with  the 
June  26,  2007  Federal  Register  changes  to  OMB  Circular  A- 133,  the  term  “reportable 
condition”  has  been  replaced  with  “significant  deficiency”  to  conform  with  current 
auditing  standards. 

The  need  to  update  the  Contract  Audit  Manual  terminology  on  communicating  matters 
related  to  internal  control  was  previously  reported  in  our  audit  report  D-201 1-6-002, 
dated  October  29,  2010  “Report  on  Quality  Control  Review  of  the  Deloitte  &  Touche  and 
the  Defense  Contract  Audit  Agency  FY  2008  Single  Audit  of  the  Aerospace 
Corporation”.  DCAA  management  concurred  with  our  comments  and  agreed  to  take 
corrective  actions.  However,  until  the  corrective  actions  are  complete  we  will  continue  to 
include  the  finding  and  the  recommendation  for  revisions  in  our  reports  when 
appropriate. 

Conclusion.  The  deficiencies  disclosed  by  our  review  indicate  that  DCAA  management 
needs  to  implement  more  effective  quality  control  procedures  for  the  Circular  A- 133 
audits  and  provide  additional  training  in  auditing  standards  and  OMB  Circular  A- 133 
requirements  to  auditors  performing  OMB  Circular  A- 133  audits. 
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Finding  B.  PricewaterhouseCoopers’  Performance  and  Documentation  of  the 
Federal  Program  Audit.  The  procedures  performed  by  the  PricewaterhouseCoopers 
auditors  were  not  sufficient  to  identify  the  existence  of  special  tests  and  provisions  in  the 
Laboratory’s  contracts.  As  a  result,  they  did  not  perform  the  required  review  and  testing 
of  internal  control  over  and  compliance  with  provisions  for  key  personnel.  In  addition, 
the  documentation  of  the  federal  program  audit  needs  to  be  improved  in  future  single 
audits  to  provide  a  clear  audit  trail  to  the  specific  procedures  relied  on  to  support  the 
conclusions  on  compliance  with  Federal  requirements. 

Special  Tests  and  Provisions  Compliance  Testing.  The  auditors  reviewed  a 
sample  of  10  contracts  and  concluded  that  there  were  no  special  tests  and  provisions 
requirements  for  those  awards.  During  our  site  visit,  we  re-tested  five  of  the  ten  contracts 
to  assess  the  adequacy  of  the  auditor’s  conclusions  and  determined  that  three  of  the  five 
contracts  contained  key  personnel  requirements.  We  discussed  our  findings  with  the 
auditor  and  were  advised  that  the  contracts  reviewed  contained  the  “key  personnel” 
clause  but  key  personnel  were  not  identified  so  the  auditor  concluded  that  the  clause  was 
not  exercised. 

Because  there  was  a  discrepancy  between  the  results  of  our  review  and  the  auditor’s 
review,  we  contacted  the  Laboratory’s  contracting  officer.  Based  on  our  discussions  with 
the  contracting  officer’s  representative,  we  determined  that  the  auditor’s  conclusions 
were  based  on  a  review  of  the  general  provisions  in  the  basic  ordering  agreements  rather 
than  on  the  specific  requirements  included  in  individual  contract  delivery  orders  issued 
under  the  agreement.  As  described  in  the  Federal  Acquisition  Regulation  section 
16.703(a),  a  basic  ordering  agreement  is  not  a  contract,  rather  it  is  a  written 
understanding  between  the  parties  that  contains  terms  and  clauses  applicable  to  future 
contracts  (orders)  issued  under  the  agreement;  as  a  result,  specific  key  personnel 
requirements  are  identified  in  the  individual  contracts  orders.  Future  procedures  to 
identify  the  existence  of  special  terms  and  provisions  should  include  reviewing  individual 
contract  orders  issued  under  basic  ordering  agreements.  The  contracting  officer  also 
advised  us  that  the  auditors  can  contact  the  procuring  contracting  officer  for  key 
personnel  information. 

Workpaper  Documentation.  The  documentation  of  the  audit  procedures 
performed  for  the  Laboratory’s  oversight  of  for-profit  and  vendor  organizations  and  the 
internal  control  review  and  the  compliance  audit  of  special  tests  and  provisions,  cash 
management,  and  reporting  requirements  did  not  always  provide  sufficient  detail  for  the 
reviewer  to  evaluate  the  adequacy  of  the  audit  procedures  performed  and  the  sufficiency 
of  audit  evidence.  As  a  result,  the  auditors  were  required  to  provide  additional  verbal 
explanations  and  documentation  from  the  financial  statement  audit  to  support  the  Federal 
audit. 
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Government  auditing  standards  require  that  sufficient  detail  be  included  in  the  audit 
documentation  to  provide  an  experienced  auditor  who  has  no  previous  connection  with 
the  audit  to  ascertain  from  the  documentation  that  the  evidence  supports  the  auditor’s 
significant  judgments  and  conclusions.  Audit  documentation  should  be  appropriately 
detailed  to  provide  a  clear  understanding  of  its  purpose  and  source,  and  should  be 
appropriately  organized  to  provide  a  clear  link  to  the  findings,  conclusions,  and 
recommendations. 

Finding  C.  Charles  Stark  Draper  Laboratory  Responsibility  for  Obtaining  Audit 
Coverage  in  Accordance  with  Circular  A-133  Requirements.  The  Laboratory  did 
not  ensure  that  the  FY  2008  audit  covered  the  entire  research  and  development  program 
cluster.  As  a  result,  $  1 8  million  of  direct  cost  incurred  on  federal  awards  was  not 
included  in  the  Circular  A-133  audit.  The  Laboratory's  research  and  development  cluster 
includes  contracts  that  have  externally  imposed  restrictions  on  auditor  access  to  awards. 
Because  of  these  restrictions,  the  auditors  were  unable  to  gain  access  to  certain  awards  or 
perform  other  audit  procedures,  to  assess  the  Laboratory's  compliance  with  applicable 
federal  requirements.  Without  the  appropriate  audit  coverage  awarding  agencies  cannot 
rely  on  the  Circular  A-133  audit  as  intended  by  the  Single  Audit  Act  to  maintain 
accountability  over  spending  or  use  the  audit  results  to  manage  and  monitor  the  entity’s 
use  of  federal  funds. 

Circular  A-133  assigns  the  auditee  (the  Laboratory)  the  responsibility  for  procuring 
auditors  to  perform  the  required  annual  audit  of  the  financial  statements  and  major 
federal  programs.  This  includes  ensuring  that  the  auditors  are  aware  of  the  objectives  and 
scope  of  the  audit  and  have  the  qualifications  and  technical  abilities  to  perform  an  audit 
of  the  entire  research  and  development  program  in  accordance  with  Circular  A-133 
requirements. 

Recommendations  and  Management  Comments 

1.  We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 

a.  Revise  the  Defense  Contract  Audit  Agency  Circular  A-133  standard 
audit  program  to  include  the  procedures  required  by  the  American 
Institute  of  Certified  Public  Accountants  Statements  on  Auditing 
Standards§316,  “Consideration  of  Fraud  in  a  Financial  Statement 
Audit.” 

b.  Revise  the  DCAA  Contract  Audit  Manual  Chapter  13,”Audits  at 
Educational  Institutions,  Nonprofit  Organizations,  and  Federally 
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Funded  Research  and  Development  Centers  (FFRDCs),”  to  include 
guidance  on  performing  fraud  risk  assessment  procedures  and 
reporting  in  the  Circular  A-133  audit  report. 

c.  Revise  the  Contract  Audit  Manual  Chapter  13-703  “Coordinated  Audit 
Approach”  to  provide  additional  guidance  for  relying  on  the  work  of 
non-auditors. 

d.  Review  the  A-133  audit  program  and  the  Contract  Audit  Manual, 
Chapter  13,  to  ensure  the  guidance  conforms  with  the  American 
Institute  of  Certified  Public  Accountants’  Statements  on  Auditing 
Standards  117  “Compliance  Audits.” 

DCAA  Comments.  The  Director,  DCAA  agreed  to  take  the  recommended 
actions.  Management  comments  are  included  in  their  entirety  at  the  end  of  this 
report. 

2.  We  recommend  that  the  Branch  Manager,  Boston  Branch  Office,  Defense 
Contract  Audit  Agency: 

a.  Revise  the  FY  2008  Circular  A-133  report  single  audit  report,  to 
include  the  circumstances  surrounding  the  compliance  opinion 
qualification  in  the  schedule  of  findings  and  questioned  costs. 

b.  Forward  the  report  to  the  Laboratory  for  submission  to  the  Federal 
Audit  Clearinghouse. 

c.  Issue  Cost  Accounting  Standards  CAS  405  and  406  noncompliance 
reports  to  the  Administrative  Contracting  Officer  for  appropriate 
actions. 

d.  Strengthen  existing  or  implement  additional  quality  control  procedures 
for  Offices  of  Management  and  Budget  Circular  A-133  audits  to  ensure 
that  future  audits  comply  with  auditing  standards  and  Circular  A-133 
requirements  for  the  planning,  performance  and  documentation  of  the 
audit. 

e.  Provide  staff  performing  Circular  A-133  audits  formal  training  in  the 
application  and  implementation  of  auditing  standards  in  meeting 
Circular  A-133  audit  requirements. 
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DCAA  Comments.  The  Branch  Manager,  Boston  Branch  Office,  DCAA  agreed 
to  take  the  recommended  actions.  Management  comments  are  included  in  their 
entirety  at  the  end  of  this  report. 

3.  We  recommend  that  the  Audit  Partner,  PricewaterhouseCoopers,  LLP  take 
the  following  actions  in  future  single  audits: 

a.  Perform  as  necessary,  appropriate  procedures  to  identify  the  existence 
of  special  tests  and  provisions  in  the  Laboratory’s’  contracts. 

b.  Improve  work  paper  documentation  for  the  internal  control  review 
and  compliance  audit  of  the  cash  management,  reporting,  special  tests 
and  provisions  and  the  Laboratory’s  oversight  of  for-profit  and  vendor 
organizations  to  ensure  compliance  with  government  auditing 
standards  and  Circular  A-133  requirements. 

PwC  Comments.  The  Audit  Partner,  PwC,  agreed  to  take  the  recommended 
actions.  Management  comments  are  included  in  their  entirety  at  the  end  of  this 
report. 

4.  We  recommend  that  the  Vice  President  and  Treasurer,  Charles  Stark  Draper 
Laboratory: 

a.  Take  future  actions  to  ensure  that  the  single  audits  cover  all  programs 
in  the  research  and  development  cluster  as  required  under  OMB 
Circular  A-133. 

b.  Upon  receipt  of  the  revised  report  from  DCAA,  file  the  revised 

FY  2008  Circular  A-133  reporting  package  and  Data  Collection  Form 
with  the  Federal  Audit  Clearinghouse  and  notify  the  DoD  Office  of 
Inspector  General  upon  completion. 

The  Laboratory  Comments.  The  Vice  President  for  Finance  and  Administration 
and  Treasurer,  Charles  Stark  Draper  Laboratory,  Incorporated  agreed  to  take  the 
recommended  actions.  Management  comments  are  included  in  their  entirety  at  the 
end  of  this  report. 
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We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Ms.  Janet  Stern  at  (703)  604-8750 
(DSN  664-8750). 

_ 


Randolph  R.  Stone 
Deputy  Inspector  General 
for  Policy  and  Oversight 
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Appendix  A.  Quality  Control  Review  Process 

Background,  Scope  and  Methodology 

The  Single  Audit  Act,  Public  Law  98-502,  as  amended,  was  enacted  to  improve  the 
financial  management  of  State  and  Local  Governments,  and  nonprofit  organizations  by 
establishing  a  uniform  set  of  auditing  and  reporting  requirements  for  all  Federal  award 
recipients  required  to  obtain  a  single  audit.  OMB  Circular  A- 133  establishes  policies  that 
guide  the  implementation  of  the  Single  Audit  Act,  and  provides  an  administrative 
foundation  for  uniform  audit  requirements  of  non-Federal  entities  administering  Federal 
awards.  Entities  that  expend  $500,000  or  more  in  a  year  are  subject  to  the  Single  Audit 
Act  and  audit  requirements  in  OMB  Circular  A- 133.  Therefore,  they  must  have  an 
annual  single  or  program- specific  audit  performed  under  government  auditing  standards 
and  submit  a  complete  reporting  package  to  the  Federal  Audit  Clearinghouse. 

We  reviewed  the  PricewaterhouseCoopers,  LLP  and  the  Defense  Contract  Audit  Agency, 
Boston  Branch  Office,  FY  2008  single  audit  of  The  Charles  Stark  Draper  Laboratory, 
Incorporated  and  the  reporting  package  that  was  submitted  to  the  Federal  Audit 
Clearinghouse  on  March  3 1 ,  2009,  using  the  1 999  edition  of  the  “Uniform  Quality 
Control  Guide  for  the  A- 133  Audits”  (the  Guide).  The  Guide  applies  to  any  single  audit 
that  is  subject  to  the  requirements  of  OMB  Circular  A- 133  and  is  the  approved 
President’s  Council  on  Integrity  and  Efficiency  Checklist  used  for  performing  quality 
control  reviews.  We  performed  the  review  from  November  2009  through 
December  2010.  The  review  focused  on  the  following  qualitative  aspects  of  the  single 
audit: 


•  Qualification  of  Auditors, 

•  Independence, 

•  Due  Professional  Care, 

•  Planning  and  Supervision, 

•  Audit  Follow-up, 

•  Internal  Control  and  Compliance  testing, 

•  Schedule  of  Expenditures  of  Federal  Awards,  and 

•  Data  Collection  Form. 


The  President's  Council  on  Integrity  and  Efficiency  and  the  Executive  Council  on  Integrity  and  Efficiency  combined  into  the 
Council  of  the  Inspectors  General  on  Integrity  and  Efficiency  in  accordance  with  the  Inspector  General  Reform  Act  of  2008. 
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Prior  Quality  Control  Reviews 


Since  October  1,  2006,  we  performed  one  quality  control  review  of  DCAA  and  two  of 
PricewaterhouseCoopers  OMB  Circular  A-133  audits.  All  audits  contained  deficiencies 
resulting  in  findings  and  recommendations  on  audit  planning/coordination,  performance, 
reporting  and  documentation.  Unrestricted  IG  DoD  reports  can  be  accessed  at 
http://www.dodig.mil/audit/reports. 

IG  DoD  Reports 

IG  DoD  Report  No.D-201 1-6-002,  “Report  on  Quality  Control  Review  of  the  Deloitte  & 
Touche  and  the  Defense  Contract  Audit  Agency  FY  2008  Single  Audit  of  the  Aerospace 
Corporation,  ”  October  29,  2010 

IG  DoD  Report  No. D-2008-6-003, “Report  on  Quality  Control  Review  of  FY  2006  Single 
Audit  of  Logistics  Management  Institute,”  March  19,  2008 

IG  DoD  Report  No.  D-2008-6-002,  “Quality  Control  Review  of  FY  2006  Single  Audit  of 
Syracuse  Research  Corporation,”  January  25,  2008 
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Appendix  B.  Compliance  Requirements* 


OMB  Circular  A-133  Compliance  Requirements 

Applicable 

Not  Applicable/ 
Not  Material 

DCAA 

PwC 

Activities  Allowed/Unallowed 

X 

Allowable  Costs/Cost  Principles 

X 

Cash  Management 

X 

Davis-Bacon  Act 

X 

Eligibility 

X 

Equipment  and  Real  Property  Management 

X 

Matching,  Level  of  Effort,  Eannarking 

X 

Period  of  Availability  of  Federal  Funds 

X 

Procurement,  Suspension,  and  Debarment 

X 

Program  Income 

X 

Real  Property  Acquisition  and  Relocation  Assistance 

X 

Reporting 

X 

Subrecipient  Monitoring 

X 

Special  Tests  and  Provisions 

X 

*This  chart  reflects  the  auditor’s  determination  on  compliance  requirement  applicability  and 
materiality. 
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Defense  Contract  Audit  Agency  Comments 


DEFENSE  CONTRACT  AUDIT  AGENCY 
DEPARTMENT  OF  DEFENSE 

8725  JOHN  J.  KINSMAN  ROAD.  SUITE  2I3S 
FORT  Btl.VOlR,  V  A  220S0  «2IS 


OFFICE  OF  THE  DIRECTOR 

January  24, 201 1 

MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE,  OFFICE  OF  INSPECTOR 

GENERAL,  DEPUTY  INSPECTOR  GENERAL  FOR  POLICY  AND 

OVERSIGHT 

ATTENTION:  Mr.  Randolph  R.  Stone 

SUBJECT.  Response  to  Department  of  Defense  Office  of  Inspector  General  (DoDIG)  Draft 
Report.  Quality  Control  Review  of  the  PricewaterhouseCoopers,  LLP  and  Defense 
Contract  Audit  Agency  FY  2008  Single  Audit  of  the  Charles  Stark  Draper 
Laboratory,  dated  December  3,  2010  (Project  No.  D20I0-DIP0AC-004O.00O) 

Thank  you  for  the  opportunity  to  respond  to  the  subject  draft  report.  Quality  Control 
Review  of  the  PricewaterhouseCoopers,  LLP  and  Defense  Contract  Audit  Agency  FY  2008 
Single  Audit  oj  the  Charles  Stark  Draper  Laboratory  The  following  are  DCAA's  comments  and 
responses  to  each  of  the  recommendations  impacting  DCAA. 

DoDIG  Recommendation  l.a:  We  recommend  that  the  Director,  Defense  Contract  Audit 
Agency,  revise  the  Defense  Contract  Audit  Agency  Circular  A-133  standard  audit  program  to 
include  the  procedures  required  by  the  American  Institute  of  Certified  Public  Accountants 
Statements  on  Auditing  Standards^  1 6,  "Consideration  of  Fraud  in  a  Financial  Statement  Audit." 

DCAA  Response:  Concur.  By  March  2011,  DCAA  will  revise  the  A-133  Standard  Audit 
Program  to  include  the  procedures  required  by  the  American  Institute  of  Certified  Public 
Accountants  Statements  on  Auditing  Standards  Section  316,  "Consideration  of  Fraud  in  a 
Financial  Statement  Audit.”  Also.  DCAA  will  add  additional  procedures  on  reporting  identified 
fraud,  in  accordance  with  OMB  Circular  A-133  Section  510(a)(6)  and  GAGAS  Section  5.10. 

DoDIG  Recommendation  Lb:  We  recommend  that  the  Director,  Defense  Contract  Audit 
Agency,  revise  the  DCAA  Contract  Audit  Manual  Chapter  13,"Audits  at  Educational 
Institutions,  Nonprofit  Organizations,  and  Federally  Funded  Research  and  Development  Centers 
(FFRDCs),"  to  include  guidance  on  performing  fraud  risk  assessment  procedures  and  reporting 
the  Circular  A-133  audit  report. 

DCAA  Response:  Concur.  By  March  2011,  DCAA  will  update  the  Contract  Audit  Manual, 
Chapter  13,  to  provide  guidance  on  performing  fraud  risk  assessment  procedures  and  reporting  in 
the  A-133  audit  report,  in  accordance  with  OMB  Circular  A-133  and  A1CPA  Auditing 
Standard  3 1 6  requirements. 
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SUBJECT:  Response  to  Department  of  Defense  Office  of  Inspector  General  (DoDIG)  Drafl 

Report,  Quality  Control  Review  of  the  PricewalerhouseCoopers,  LLP  and  Defense 
Contract  Audit  Agency  FY  2008  Single  Audit  of  the  Charles  Stark  Draper 
Laboratory,  dated  December  3,  20 1 0  (Project  No.  D20 1 0-D1POAC-0040.0001 

DoDIG  Recommendation  l.c:  We  recommend  that  the  Director,  Defense  Contract  Audit 
Agency,  revise  the  Contract  Audit  Manual  Chapter  13-703  "Coordinated  Audit  Approach  to 
provide  additional  guidance  for  relying  on  the  work  of  non-auditors. 

DCAA  Response:  Concur  in  principle.  By  June  2011,  we  will  reassess  whether  it  is  correct  to 
rely  on  the  work  of  DCMA  to  accomplish  the  objectives  of  certain  Circular  A-133  compliance 
requirements.  If  our  assessment  deems  the  practice  appropriate,  we  will  update  the  Contract 
Audit  Manual,  Chapter  13  to  provide  additional  guidance  for  relying  on  the  work  of  non¬ 
auditors.  Additional  guidance  will  address  the  performance  of  steps  necessary  to  place  reliance 
on  non-auditor  work  and  discuss  factors  that  would  influence  the  extent  of  procedures,  such  as. 
the  significance  of  the  non-auditor  work  to  the  audit  objectives  and  degree  the  work  will  be 
used  to  support  the  audit  conclusions. 

DoDIG  Recommendation  l.d:  We  recommend  that  the  Director,  Defense  Contract  Audit 
Agency,  review  the  A-133  audit  program  and  the  Contract  Audit  Manual,  Chapter  1 3,  to  ensure 
the  guidance  conforms  to  the  American  Institute  of  Certified  Public  Accountants  Statements  on 
Auditing  Standards,  Statement  on  Auditing  Standards  1 17  “Compliance  Audits." 

DCAA  Response:  Concur.  By  April  2011,  DCAA  will  update  the  A-133  audit  program  and  the 
Contract  Audit  Manual.  Chapter  1 3,  to  ensure  the  guidance  conforms  to  the  American  Institute  of 
Certified  Public  Accountants  Statements  on  Auditing  Standards,  Statement  on  Auditing 
Standards  1 1 7  “Compliance  Audits.” 

DoDIG  Recommendation  2.a:  We  recommend  that  the  Branch  Manager,  Boston  Branch 
Office,  Defense  Contract  Audit  Agency,  revise  the  FY  2008  Circular  A-133  report  single  audit 
report,  to  include  the  circumstances  surrounding  the  compliance  opinion  qualification  in  the 
schedule  of  findings  and  questioned  costs. 

DCAA  Response:  Concur.  The  circumstances  surrounding  the  compliance  opinion 
qualification  are  fully  explained  in  the  Scope  of  Audit  section  (Pages  2  and  3)  of  our  audit  report. 
However,  to  address  the  DoDIG’s  concerns,  we  will  revise  our  audit  report  to  include  the  same 
information  in  the  schedule  of  findings  and  questioned  costs  section  by  March  1 , 201 1 . 

DoDIG  Recommendation  2.b:  We  recommend  that  the  Branch  Manager,  Boston  Branch 
Office,  Defense  Contract  Audit  Agency,  forward  the  report  to  the  Laboratory  for  submission  to 
the  Federal  Audit  Clearinghouse. 

DCAA  Response:  Concur.  The  FAO  will  provide  CSDL  with  a  copy  of  the  supplemental  audit 
report  for  submission  to  the  Federal  Audit  Clearinghouse  by  March  1 ,  201 1 . 
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SUBJECT:  Response  to  Department  of  Defense  Office  of  Inspector  General  (DoDIG)  Drafl 

Report,  Quality  Control  Review  of  the  PricewalerhouseCoopers,  LLP  and  Defense 
Contract  Audit  Agency  FY  2008  Single  Audit  of  the  Charles  Stark  Draper 
Laboratory,  dated  December  3, 2010  (Project  No  D2010-DIPOAC-0040.000) 


DoDIG  Recommendation  2.c:  We  recommend  that  the  Branch  Manager,  Boston  Branch 
Office,  Defense  Contract  Audit  Agency,  issue  Cost  Accounting  Standards  CAS  405  and  400 
noncompliance  reports  to  the  Administrative  Contracting  Officer  for  appropriate  actions. 

DCAA  Response:  Concur 

CAS  405  (Concur):  We  have  set  up  Assignment  No.  02)71-201 1 T 1920000 1  to  address  the  CAS 
405  noncompliance.  The  CAS  405  noncompliance  report  will  be  issued  to  the  ACO.  Our 
anticipated  report  issuance  date  is  March  1, 201 1. 

CAS  409  (Concur  in  principle):  We  re-evaluated  this  audit  finding  and  concluded  that  it 
represents  a  CAS  406  noncompliance  as  opposed  to  a  CAS  409  noncompliance.  Therefore,  we 
will  be  setting  up  a  separate  assignment  to  address  this  issue.  The  CAS  406  noncompliance 
report  will  be  issued  to  the  ACO.  Our  anticipated  report  issuance  date  is  March  1,  201 1.  In 
addition,  we  will  also  revise  the  applicable  audit  report  note  in  the  FY  2008  A- 1 33  audit  report  to 
reflect  the  CAS  406  noncompliance  reference.  This  change  will  coincide  with  the  response  to 
Recommendation  2.b  (see  above). 

DoDIG  Recommendation  2,d:  We  recommend  that  the  Branch  Manager.  Boston  Branch 
Office.  Defense  Contract  Audit  Agency,  strengthen  existing  or  implement  additional  quality 
control  procedures  for  Office  of  Management  and  Budget  Circular  A-l  33  audits  to  ensure  that 
future  audits  comply  with  auditing  standards  and  Circular  A-133  requirements  for  the  planning, 
performance  and  documentation  of  the  audit. 

DCAA  Response:  Concur.  By  March  1. 201 1.  the  FAO  will  re-evaluate  its  current  quality 
control  procedures  specifically  as  they  relate  to  A- 1 33  audits  and  determine  what  steps  cun  be  put 
into  practice  to  strengthen  existing  or  implement  additional  quality  control  procedures.  This  will 
ensure  that  future  audits  are  planned,  performed,  documented,  and  reported  in  compliance  with  all 
applicable  auditing  standards  and  OMB  Circular  A-133  requirements.  Our  current  quality  control 
procedures  (Northeastern  Regional  Instruction  7640.22,  dated  April  13, 2010)  state  that  the 
Regional  Audit  Manager  and  a  Regional  or  FAO  Technical  Specialist  will  review  all  OMB 
Circular  A-133  reports  and  working  papers  prior  to  report  issuance.  The  Technical  Specialist  will 
review  the  working  papers  for  technical  sufficiency  (compliance  with  OMB  Circular  A-133 
requirements,  compliance  with  the  audit  program,  scope  of  audit  reflects  level  of  risk  assessment, 
and  the  working  papers  contain  sufficient  supporting  documentation  to  support  the  audit 
conclusion),  and  document  that  review  using  the  Technical  Specialist  Review  Form  contained  in 
Regional  Memorandum  97-RS-0I5,  dated  25  February  1997. 

DoDIG  Recommendation  2,e:  We  recommend  that  the  Branch  Manager,  Boston  Branch 
Office,  Defense  Contract  Audit  Agency,  provide  staff  performing  Circular  A-133  audits  with 
formal  training  in  the  application  and  implementation  of  auditing  standards  in  meeting 
Circular  A-133  audit  requirements. 
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SUBJECT:  Response  lo  Department  of  Defense  Office  of  Inspector  General  (DoDIG)  Draft 

Report,  Quality  Control  Review  oj  the  PricewaterhouseCoopers,  LLP  and  Defense 
Contract  Audit  Agency  FY  2008  Single  Audit  of  the  Charles  Stark  Draper 
Laboratory,  dated  December  3, 2010  (Project  No.  D2010-DIPOAC-0040.000) 

DCAA  Response:  Concur.  By  March  1,  2011,  the  FAO  will  ensure  that  Auditors  and 
Supervisors  performing  OMB  Circular  A- 133  compliance  audits  have  training  in  the  application 
and  implementation  of  auditing  standards  in  meeting  Circular  A-133  audit  requirements  in 
accordance  with  GAGAS  3.40  and  DCAA  MRD  08-PPD-03  1(R),  dated  October  2,  2008. 
Recently,  the  entire  FAO  staff  completed  formal  training  in  GAGAS,  which  was  developed  by 
tlie  Defense  Contract  Audit  Institute  (DCAA's  training  facility).  Additionally,  the  FAO  will 
present  the  specific  DoDIG  Endings  to  auditors  performing  A-133  audits  by  March  1, 201 1. 

Please  see  the  enclosed  Northeastern  Region,  DCAA,  Responses  to  the  DoDIG  Drall 


DoDIG  Other  Matters  of  Interest:  The  DCAA  Contract  Audit  Manual,  Chapter  13,  Audits  at 
Educational  Institutions,  Nonprofit  Organizations,  and  Federally  Funded  Research  and 
Development  Centers.  Section  300,  “OMB  Circular  A-133  Audits  and  Reports,"  should  be 
updated  to  reflect  the  current  terminology  on  communicating  matters  relaled  to  internal  control, 
in  accordance  with  OMB  Circular  A-133  reporting  requirements.  Specifically,  effective  with  the 
June  26,  2007  Federal  Register  changes  to  OMB  Circular  A-133.  the  term  “reportable  condition” 
has  been  replaced  with  “significant  deficiency"  to  conform  with  current  auditing  standards, 

DCAA  Response  to  DoDIG  Other  Matters  of  Interest:  DCAA  revised  the  Contract  Audit 
Manual,  Chapter  13,  Section  700  for  the  change  in  terminology  on  communicating  matters 
related  to  internal  control,  in  accordance  with  OMB  Circular  A-133  reporting  requirements, 

Questions  regarding  this  memorandum  should  be  directed  to  Ms.  Esther  M.  Fischer. 
Chief,  Policy  Programs  Division  at  (703)  767-2297. 
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Patrick  f.  Fittgerald  VJ 


Enclosure: 

DCAA  Northeastern  Region  Response 
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Defense  Contract  Audit  Agency,  Boston  Branch 
Office,  Northeastern  Region  Comments 


RST-2  730.1 


NORTHEASTERN  REGION 

DEFENSE  CONTRACT  AUDIT  ASENCV 
DEPARTMENT  OF  DEFENSE 
59  LOWES  WAV.  SUITE  300 
LOWELL.  MASSACHUSETTS  01851-5150 

January  24, 201 1 

MEMORANDUM  FOR  THE  DIRECTOR.  DCAA 
ATTENTION:  PPD  (Ms  Esther  Fischer) 

SUBJECT:  Response  to  DoDIG  Preliminary  Review  Results  Report  on  Quality  Control 

Review  of  the  PricewaterhouseCoopers,  LLP  and  Defense  Contract  Audit  Agency 
Fiscal  Year  Single  Audit  of  Charles  Stark  Draper  Laboratory  (CSDL),  Inc. 

(Project  No.  D20IQ-D1PAOAC-0040.000) 

We  have  reviewed  the  subject  DoDIG  draft  report  findings  and  recommendations 
regarding  the  DCAA  Fiscal  Year  (FY)  2008  Single  Audit  of  Charles  Stark  Draper  Laboratory, 
Inc.  (CSDL).  The  DoDIG's  overall  conclusion  was  that  DCAA  did  not  comply  with 
Circular  A-133  reporting  requirements.  Our  response  to  the  DoDIG  findings  and 
recommendations  as  they  relate  to  the  Boston  Branch  Office  are  as  follows: 

DoDIG  Recommendation  2.a:  "We  recommend  that  the  Branch  Manager,  Boston 
Branch  Office,  Defense  Contract  Audit  Agency,  revise  the  FY  2008  Circular  A-133  report  single 
audit  report,  to  include  the  circumstances  surrounding  the  compliance  opinion  qualification  in 
the  schedule  of  findings  and  questioned  costs". 

DCAA  Response:  Concur.  The  circumstances  surrounding  the  compliance  opinion 
qualification  are  fully  explained  in  the  Scope  of  Audit  section  (Pages  2  and  3)  of  our  audit  report 
However,  to  address  the  DoDIG’s  concerns,  we  will  revise  our  audit  report  to  include  the  same 
information  in  the  schedule  of  findings  and  questioned  costs  section  by  March  1 , 201 1 . 

DoDIG  Recommendation  2  b:  “We  recommend  that  the  Branch  Manager.  Boston 
Branch  Office,  Defense  Contract  Audit  Agency,  forward  the  report  to  CSDL  for  submission  to 
the  Federal  Audit  Clearinghouse" 

DCAA  Response:  Concur  The  FAO  will  provide  CSDL  with  a  copy  of  the 
supplemental  audit  report  for  submission  to  the  Federal  Audit  Clearinghouse  by  March  1,  201 1. 

DoDIG  Recommendation  2.c:  "We  recommend  that  the  Branch  Manager,  Boston 
Branch  Office,  Defense  Contract  Audit  Agency,  issue  Cost  Accounting  Standards  CAS  405  and 
CAS  409  noncompliance  reports  to  the  Administrative  Contracting  Officer  (ACOJ  for 
appropriate  actions.  “ 


f  JU.I  J  .  . 

SUBJECT:  Response  to  DoDIG  Preliminary  Review  Results  Report  on  Qual^cLlro'f  ^  ' 
Review  of  the  PricewaterhouseCoopcrs,  LLP  and  Defense  Contract  Audit  Agency 
Fiscal  Year  Single  Audit  of  Charles  Stark  Draper  Laboratory  (CSDL),  Inc. 

(Project  No.  D2010-D1PAOAC-0040.000) 

DCAA  Response:  Concur 

CAS  405  (Concur):  We  have  set  up  Assignment  No.  02171-201 1T19200001  to  address 
the  CAS  405  noncompliance.  The  CAS  405  noncompliance  report  will  be  issued  to  the  ACO. 
Our  anticipated  report  issuance  date  is  March  I.  201 1. 

CAS  409  (Concur):  Wc  re-evaluated  this  audit  finding  and  concluded  that  it  represents  a 
CAS  406  noncompliance  as  opposed  to  a  CAS  409  noncompliance.  Therefore,  we  will  be 
setting  up  a  separate  assignment  to  address  this  issue.  The  CAS  406  noncompliance  report  will 
be  issued  to  the  ACO  Our  anticipated  report  issuance  date  is  March  1 ,  2011 .  In  addition,  wc 
will  also  revise  the  applicable  audit  report  note  in  the  FY  2008  A- 133  audit  report  to  reflect  the 
CAS  406  noncompliance  reference.  This  change  will  coincide  with  the  response  to 
Recommendation  2.b  (see  above). 

DoDIG  Recommendation  2.d:  "I Ve  recommend  that  the  Branch  Manager.  Boston 
Branch  Office,  Defense  Contract  Audit  Agency,  strengthen  existing  or  implement  additional 
quality  control  procedures  for  Offices  of  Management  and  Budget  Circular  A- 1 33  audits  to 
ensure  that  future  audits  comply  with  auditing  standards  and  Circular •  A-133  requirements  for 
the  planning,  performance  and  documentation  of  the  audit 

DCAA  Response:  Concur.  By  March  1,  2011,  the  FAO  will  re-evaluate  its  current 
quality  control  procedures  specifically  as  they  relate  to  A-133  audits  and  determine  what  steps 
can  he  put  into  practice  to  strengthen  existing  or  implement  additional  quality  control 
procedures.  This  will  ensure  that  future  audits  are  planned,  performed,  documented,  and 
reported  in  compliance  with  all  applicable  auditing  standards  and  OMB  Circular  A-133 
requirements.  Our  current  quality  control  procedures  (Northeastern  Regional  Instruction 
7640.22.  dated  April  13,  2010)  stale  that  the  Regional  Audit  Manager  and  a  Regional  or  KAO 
Technical  Specialist  will  review  all  OMB  Circular  A-133  reports  and  working  papers  prior  to 
report  issuance.  The  Technical  Specialist  will  review  the  working  papers  for  technical 
sufficiency  (compliance  with  OMB  Circular  A-133  requirements,  compliance  with  the  audit 
program,  scope  of  audit  reflects  level  of  nsk  assessment,  and  the  working  papers  contain 
sufficient  supporting  documentation  to  support  the  audit  conclusion),  and  document  that  review 
using  the  Technical  Specialist  Review  Form  contained  in  Regional  Memorandum  97-RS-015, 
dated  25  February  1 997. 

DoDIG  Recommendation  2.c:  “iVe  recommend  that  the  Branch  Manager.  Boston 
Branch  Office,  Defense  Contract  Audit  Agency,  provide  staff  performing  Circular  A-133  audits 
formal  training  in  the  application  and  implementation  of  auditing  standards  in  meeting  Circular 
A-133  audit  requirements". 
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RST-2  730. 1  January  24, 20 1 1 

SUBJECT:  Response  to  DoDIG  Preliminary  Review  Results  Report  on  Quality  Control 

Review  of  the  PriccwaterhouseCoopers,  LLP  and  Defense  Contract  Audit  Agency 
Fiscal  Year  Single  Audit  of  Charles  Stark  Draper  Laboratory  (CSDL),  Inc. 

(Project  No.  D201 0-DIP AOAC-0040.000) 

DCAA  Response:  Concur.  The  FAO  will  ensure  that  Auditors  and  Supervisors 
performing  OMB  Circular  A- 133  compliance  audits  have  training  in  the  application  and 
implementation  of  auditing  standards  in  meeting  Circular  A- 1 33  audit  requirements  in 
accordance  with  GAGAS  3.40  and  DCAA  MRD  08-PPD-031(R),  dated  October  2,  2008,  by 
March  1 , 201 1 .  Recently,  the  entire  FAO  staff  completed  formal  training  in  GAGAS,  which  was 
developed  by  the  Defense  Contract  Audit  Institute  (DCAA's  training  facility).  Additionally,  the 
FAO  will  present  the  specific  DoDIG  findings  to  Auditors  performing  A-133  audits  by  March  1, 
2011. 


Questions  regarding  this  memorandum  should  be  directed  to  Mr.  John  F.  Gay,  Branch 
Manager,  Boston  Branch  Office,  at  (617)  753-3410. 


Ronald  C.  Meldonian 
Regional  Director 
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PricewaterhouseCoopers,  LLP  Comments 


pwc 

February  4,  2011 

Mr  Randolph  Stone 
Assistant  Inspector  General 
Department  of  Defense  Inspector  General 
400  Army  Navy  Drive  (Room  1030) 
Arlington,  VA  22202-4704 

Dear  Mr  Stone: 


Thank  you  for  providing  a  draft  of  the  proposed  report,  Report  on  Quality  Control  Review  of  the 
PricewaterhouseCoopers  LLP  and  Defense  Contract  Audit  Agency  FY2008  Single  Audit  of  Charles  Stark 
Draper  Laboratory.  ( Project  No  D2009-DIPOAC-0040)  ("The  Report")  related  to  our  FY2008  Single  Audit 
of  Charles  Stark  Draper  Laboratory  We  have  reviewed  the  Department  of  Defense  draft 
recommendations  based  on  the  quality  control  review  conducted  by  Felicia  Fuller  while  onsite  at  our 
Boston  office  during  the  week  of  November  9,  2009 

Review  Results 

Review  Results.  The  DoD  Office  of  Inspector  General  (OIG)  indicated  that  the  PncewaterhouseCoopers 
audit  of  the  financial  statements  and  the  research  and  development  program  cluster  generally  met 
auditing  standards  and  Circular  A-133  requirements.  However,  OIG  identified  a  deficiency  in  the  review  of 
special  tests  and  provisions  and  the  sufficiency  of  audit  documentation  that  needs  to  be  corrected  in 
future  audits  (Finding  B) 

PwC  Response.  See  responses  to  individual  comments  below 


Finding  B.  PricewaterhouseCoopers'  Performance  and  Documentation  of  the  Federal  Program 
Audit.  The  procedures  performed  by  the  PricewaterhouseCoopers  auditor  were  not  sufficient  to  identify 
the  existence  of  special  tests  and  provisions  in  the  Laboratory's  contracts.  As  a  result,  they  did  not 
perform  the  required  review  and  testing  of  internal  control  over  and  compliance  with  provisions  for  key 
personnel.  In  addition,  the  documentation  of  the  federal  program  audit  needs  to  be  improved  in  future 
single  audits. 

PwC  Response.  See  responses  to  individual  comments  below 


Special  Tests  and  Provisions  Compliance  Testing 

Finding:  Special  Tests  and  Provisions  Compliance  Testing.  The  auditors  reviewed  a  sample  of  10 
contracts  and  concluded  that  there  were  no  special  tests  and  provision  requirements  for  those  awards 
Dunng  the  OIG  site  visit,  they  re-tested  five  of  the  ten  contracts  to  assess  the  adequacy  of  the  auditor's 
conclusions  and  determined  that  three  of  the  five  contracts  contained  key  personnel  requirements  OIG 
discussed  their  findings  with  the  auditor  and  were  advised  that  the  contracts  reviewed  contained  the  "key 
personnel’  clause  but  key  personnel  were  not  identified  so  the  auditor  concluded  that  the  clause  was  not 
exercised 


PricewaterhouseCoopers  LLP.  125  High  Street,  Boston.  MA  021  to 
T:  (61?)  530  5000,  F:  (617)  530  5001,  wwrv.pwc.com/us 
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Because  there  was  a  discrepancy  between  the  results  of  the  OIG  review  and  the  auditors  review,  OIG 
contacted  the  Laboratory  contracting  officer.  Based  on  OIG's  discussions  with  the  contracting  officer  s 
representative,  they  determined  that  auditor's  conclusions  were  based  on  a  review  of  the  general 
provisions  in  basic  ordering  agreements  rather  than  on  the  specific  requirements  included  in  individual 
contract  delivery  orders  issued  under  the  agreement  As  described  in  FAR  16  703(a).  a  basic  ordenng 
agreement  is  not  a  contract,  rather  it  is  a  written  understanding  between  the  parties  that  contains  terms 
and  clauses  applicable  to  future  contracts  (orders)  issued  under  the  agreement;  as  a  result  specific  key 
personnel  requirements  are  identified  in  the  individual  contracts  orders  Future  procedures  to  identify  the 
existence  of  special  terms  and  provisions  conditions  should  include  reviewing  individual  contract  orders 
issued  under  basic  ordering  agreements.  The  contracting  officer  also  advised  OIG  that  the  auditors  can 
contact  the  procuring  contracting  officer  for  key  personnel  information 

Recommendation:  We  recommend  that  the  Audit  Partner,  PricewaterhouseCoopers  LLP  take  the 
following  actions  in  future  single  audits: 

a  Perform  as  necessary,  appropriate  procedures  to  identify  the  existence  of  special  tests  and 
provisions  in  the  Laboratory's'  contracts 

PwC  Response.  The  audit  team  selected  a  sample  of  ten  contracts  from  the  files  of  Charles  Stark 
Draper  Laboratory  and  were  provided  with  copies  of  the  basic  ordering  agreements.  In  addition,  we 
inquired  of  Charies  Stark  Draper  Laboratory  employees  regarding  the  existence  of  any  key  personnel 
requirements  or  other  special  tests  and  provisions.  We  were  informed  there  were  no  other  requirements 
Through  these  procedures,  no  special  tests  and  provisions  were  identified 

In  future  audits,  we  will  specifically  request  individual  contract  delivery  orders  to  identify  the  existence  of 
any  special  tests  and  provisions  compliance  requirements. 

Work  paper  Documentation 

Finding:  Work  paper  Documentation  OIG  indicated  that  the  documentation  on  the  internal  control 
review  and  the  compliance  audit  of  special  tests  and  provisions,  cash  management,  subrecipient 
monitoring  and  reporting  requirements  did  not  always  provide  sufficient  detail  for  the  reviewer  to  evaluate 
the  adequacy  of  the  performed  audit  procedures  and  the  sufficiency  of  audit  evidence  As  a  result,  the 
auditors  were  required  to  provide  OIG  with  additional  verbal  explanations  and  documentation  from  the 
financial  statement  audit  to  support  the  audit  conclusions  Government  auditing  standards  requires  that 
sufficient  detail  be  included  in  the  audit  documentation  to  provide  an  experienced  auditor  who  has  no 
previous  connection  with  the  audit  to  ascertain  from  the  documentation  that  the  evidence  supports  the 
auditor's  significant  judgments  and  conclusions.  Audit  documentations  should  be  appropriately  detailed  to 
provide  a  clear  understanding  of  its  purpose  and  source,  and  should  be  appropriately  organized  to 
provide  a  clear  link  to  the  findings,  conclusions,  and  recommendations. 

Recommendation:  We  recommend  that  the  Audit  Partner,  PricewaterhouseCoopers  LLP  take  the 
following  actions  in  future  single  audits: 

b.  Improve  work  paper  documentation  for  the  internal  control  review  and  compliance  audit  of  the 
cash  management,  subrecipient  monitoring,  reporting  and  special  tests  and  provisions 
requirement  to  ensure  compliance  with  government  auditing  standards  and  Circular  A-133 

PwC  Response.  We  conducted  an  audit  of  Charles  Stark  Draper  Laboratory  which  consisted  of  a 
financial  statement  audit  and  an  A-133  audit,  and  our  audit  procedures  and  conclusions  were 
documented  in  two  electronic  databases.  We  believe  that  the  two  databases,  taken  as  a  whole, 
adequately  document  the  internal  control  review  and  the  compliance  audit  of  special  tests  and  provisions, 
cash  management,  subrecipient  monitoring,  and  reporting  requirements.  However,  we  do  understand  the 
importance  of  documentation  to  minimize  the  need  for  verbal  explanation 
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In  future  audits,  we  will  enhance  our  documentation  in  each  of  these  areas  to  more  clearly  document  the 
procedures  performed  We  will  also  enhance  the  cross-referencing  between  the  two  databases  to  more 
clearly  demonstrate  the  linkage  between  the  A-133  internal  control  and  compliance  testing  requirements 
and  the  audit  work  performed. 


Thank  you  for  your  consideration  of  our  response  letter 
Sincerely, 

US 


mmm 


By  Robert  J  Spear 
Engagement  Partner 
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The  Charles  Stark  Draper  Laboratory 
Comments 


Elizabeth  Mora 

Vice  President  tor  Finance  &  Administration  and  Treasurer 


December  9,2010 
Mr.  Randolph  R.  Stone 

Deputy  Inspector  General  lor  Policy  Oversight 
Department  of  Defense 
400  Army  Navy  Drive 
Arlington,  VA  22202-4704 

Subject:  Report  on  Quality  Control  Review  of  the  PriccwatcrhouscCoopers,  L.L.P,  and 
Defense  Contract  Audit  Agency  FY  2008  Single  Audit  of  Charles  Stark  Draper  Laboratory 
(Project  No.  D2009-D1PQAC-0400) 

Dear  Mr.  Stone: 

The  ( 'harlcs  Stark  Draper  Laboratory  (“the  Laboratory")  is  pleased  to  respond  to  the  two  recommendations 
contained  in  the  Draft  Report  letter  dated  December  3, 2010 

DoD  Office  of  Inspector  General  Recommendation 

I .  We  recommend  that  the  Vice  President  and  Treasurer,  Charles  Stark  Draper  Laboratory: 

a.  Take  future  actions  to  ensure  that  the  single  audit  covers  all  programs  in  the  research  and 
development  cluster  as  required  under  OMB  Circular  A-133. 
b  Upon  receipt  of  the  revised  report  from  DCAA,  file  the  revised  FY  2008  Circular  A-133 
reporting  package  and  Data  Collection  Form  with  the  Federal  Audit  Clearinghouse  and 
notify  the  DoD  Office  of  Inspector  General  upon  completion. 

Charles  Stark  Draper  Laboratory  Response 

a.  The  Laboratory  has  taken  steps  in  connection  with  the  audit  of  our  FY  2010  single  audit 
required  by  OMB  Circular  A-133  to  ensure  that  all  programs  in  the  research  and 
development  cluster  are  audited. 

b.  The  Laboratory  will  file  a  revised  FY  2008  Circular  A-133  reporting  package  to  the 
Federal  Audit  Clearinghouse  upon  receipt  of  a  revised  I  JCAA  report.  Your  office  will  be 
notified  when  the  revised  report  is  filed. 


Sincerely  yours. 


ely  you 


Elizabeth  Mora 

Vice  President  for  Finance  &  Administration 
and  Treasurer 


The  Charles  Stark  Oraper  Laboratory,  Inc. 

555  Tochnotogy  Square.  Cambridge,  Massachusetts  02139-3563 
Telephone:  617-25B-4308  Fax:  017-258-2626 
Internet:  emora@drepoT.com 
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